- syslog-ng - lists.balabit.hu

libol version problems
by Todd Snyder 12 Dec '01

12 Dec '01

Ok ... I'm really confused ... I just downloaded the most recent version of syslog-ng, and libol (0.3.1). I got 'required version not found'. so I went down to 2.9 - still the same thing. see output below: checking libol version >= 0.2.23... no configure: error: Required libol version not found [root@coupland syslog-ng-1.4.14]# libol-config --version 0.2.9 what do I do ... I need to get this up like TODAY, and I can't get it compiled. I did a quick search of the archives and didn't find anything, so I apologize if this is a common question. TIA Todd.

2 1

syslog-ng and irix
by gkuchta＠astro.umn.edu 06 Dec '01

06 Dec '01

Hi, I was wondering if syslog-ng does, or at any point will, support taking logs from non syslog-ng daemons. I've poked around the documentation and the mailing list, but I didn't see this mentioned anywhere. Our department has a few old irix machines that graduate students run Fortran code on, and we'd like to forward logs from these machines to our new syslog-ng server. I played with the idea for about 30minutes earlier today, but couldn't get anything going. Is this possible? Will it be? Much thanks, Garrett -- Garrett Kuchta [gkuchta[at]astro.umn.edu] Assistant System Manager Dept. of Astronomy University of Minnesota, Twin Cities http://www.astro.umn.edu/~gkuchta

4 3

Sample Redhat configuration?
by Bradley Hartin 05 Dec '01

05 Dec '01

Can anyone provide some sample configurations for Redhat 7.1 systems, both as a central log server and it's clients? I'm about to roll out about 130 linux boxes pretty soon, all vpn clients with various other functions, and would like to maintain a central log repository. syslog-ng looks like my best bet (I'd rather have tcp than udp, just to avoid the possibility of lost logs in case of flaky lines). Unfortunately, I don't have the time for a lot of experimentation. Thanks, -- Bradley Hartin - bhartin(a)straus-frank.com Network and Communications Administrator Straus-Frank Company

3 5

secure remote logging
by Waldemar Brodkorb 03 Dec '01

03 Dec '01

Hi *, is there a possibility to do $subject? Somebody said encryption is integrated in 1.5.13, but I can't figure it out. Nothing about this in the manpage or in the html documentation. syslog-ng works quite well, but I want to secure the network communication between the instances a little bit. Is there a solution with ssh tunnel described anywhere? TIA bye Waldemar -- Are your questions smart enough? http://www.tuxedo.org/~esr/faqs/smart-questions.html

2 1

Daemons dies
by Chuck Kelly 30 Nov '01

30 Nov '01

I am running syslog-ng 1.4.14 on two different servers. One server has approx. 150 hosts logging to it. The other server has approx. 1500 hosts logging to it. The server with 1500 hosts has a problem with the daemon dying randomly, any where from 1-15 hours. I have adjusted to the log_fifo_size to 2000. Any other ideas? Since the dameon is running fine on the other server, I assume I am just running into a performance tweaking issue. -- Chuck

1 0

src/io.c patch for libol 0.2.23
by syslog-ng＠lists.thewrittenword.com 28 Nov '01

28 Nov '01

1. alloca patch below needed for HP-UX and AIX. 2. The following is not legal C89 code: struct fd_read r = { { STACK_HEADER, do_read, do_recv }, fd->fd }; You cannot assign a non-const value at initialization time. I think C99 allows this. The Sun and HP vendor compilers complain (though the Sun version allows it because they have started to incorporate C99 features). -- albert chin (china(a)thewrittenword.com) -- snip snip --- src/io.c.orig Tue Nov 27 13:04:16 2001 +++ src/io.c Tue Nov 27 13:42:26 2001 @@ -21,11 +21,28 @@ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ +#if defined _AIX && !defined __GNUC__ + #pragma alloca +#endif + #include "io.h" #include "werror.h" #include "xalloc.h" #include "format.h" +/* Make alloca work the best possible way. */ +#ifdef __GNUC__ +#define alloca __builtin_alloca +#else /* not __GNUC__ */ +#if HAVE_ALLOCA_H +#include <alloca.h> +#else /* not __GNUC__ or HAVE_ALLOCA_H */ +#ifndef _AIX /* Already did AIX, up at the top. */ +char *alloca (); +#endif /* not _AIX */ +#endif /* not HAVE_ALLOCA_H */ +#endif /* not __GNUC__ */ + #include <assert.h> #include <string.h> @@ -327,7 +344,6 @@ { debug("Read EOF on fd %i.\n", closure->fd); return A_EOF; - return 0; } if (res > 0) return res; @@ -400,7 +416,9 @@ int res; struct fd_read r = - { { STACK_HEADER, do_read, do_recv }, fd->fd }; + { { STACK_HEADER, do_read, do_recv }, 0 }; + + r.fd = fd->fd; /* The handler function may install a new handler */ res = READ_HANDLER(self->handler, @@ -482,7 +500,9 @@ int res; struct fd_write w = - { { STACK_HEADER, do_write }, fd->fd }; + { { STACK_HEADER, do_write }, 0 }; + + w.fd = fd->fd; assert(self->buffer); @@ -652,7 +672,9 @@ int blocking_read(int fd, struct read_handler *handler) { struct fd_read r = - { { STACK_HEADER, do_read }, fd }; + { { STACK_HEADER, do_read }, 0 }; + + r.fd = fd; for (;;) {

1 0

Flags?
by Jay Guerette 27 Nov '01

27 Nov '01

Is the 'flags' statement working in syslog-ng 1.4.14? It coughs on a flags(final)entry in my conf file: log { source(syslog); filter(p_ircd); destination(ircd); flags(final); }; It parses fine when the flags line is commented out... -- I hope that at this artificial inflation of a small species into the absolute measure of things one is still permitted to laugh?

2 1

syslog-ng messages sent to outside prog
by Jay Guerette 27 Nov '01

27 Nov '01

A modified code snippet that will remove the leading <nn> facility/priority indicator when shlepping log lines to an external proggie: <code> #! /bin/bash # this line enables the extended globbing in bash to make this possible shopt -s extglob while read LOGLINE do echo ${LOGLINE/+([0-9<>])} | mail wakemeup(a)noon.ok done </code> -- I hope that at this artificial inflation of a small species into the absolute measure of things one is still permitted to laugh?

1 0

RE: [syslog-ng]syslog-ng loghost project documentation
by Ben Smee 25 Nov '01

25 Nov '01

heya, on which note just wanted to say thanks for the effort of writing that up. I had a quick look at it the other day and it helped clarify a couple of things, namely how you piped things straight into swatch (which is a nice trick). regards, -------------------- Benjamin Smee Technical Specialist Optus Business Operations (NAC) "YES" OPTUS ben.smee(a)optus.net.au Tel: +61-2-93420091 Fax: +61-2-93420998 Perilous to all of us are the devices of an art deeper than we possess ourselves. -- Gandalf the White > -----Original Message----- > From: Nate Campi [mailto:nate@campin.net] > Sent: Saturday, 24 November 2001 8:01 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]syslog-ng loghost project documentation > > > I've documented just about every part of my syslog-ng setup > at work, and place it at > http://www.campin.net/newlogcheck.html. It > covers the whole > deal, from reporting with custom log scanners, swatch, > archiving to files and to a database, and more. > > This may save others time when they are starting out on their > projects. This is a work in progress, but I'm sure it could > be useful now. > -- > Nate Campi http://www.campin.net GnuPG key: > 0xC17AEF79 > Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 > > Your mantra for today is: Don't let data from the network near a > shell. Bad things happen. -- Randall Schwartz > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/sysl> og-ng >

1 0

HI
by Olav Langeland 24 Nov '01

24 Nov '01

I am logging from a Cisco Pix to syslog-ng on a FreeBSD machine. --cut-from-syslog-ng-cfg-- destination pix { file("/usr/logs/pix/log"); }; filter f_pix { host(192.168.10.1); }; log { source(src); filter(f_pix); destination(pix); }; --cut-- This logs perfectly fine, but it still logs to /var/log/messages as well. How do I filter away this? Something I have missed, scanned through couple of months of mailinglist but didnt see anything particular. Any help appreciated, syslog-ng looks really nice. -- Olav Langeland - olav.langeland(a)nosp4m.activeisp.com

2 1